Critical SharePoint Zero-Day Vulnerability CVE-2025-53770: ToolShell Exploited In Enterprise Servers

Technical Details

CVE-2025-53770 builds on two prior vulnerabilities (CVE-2025-49706 + CVE-2025-49704) that were previously patched on July 8th, 2025. The vulnerability affects Microsoft SharePoint Server 2016, 2019, and Subscription Edition, allowing attackers to bypass authentication mechanisms through a sophisticated multi-stage attack chain.

The exploit works by sending a specially crafted HTTP POST request to the endpoint:

/_layouts/15/ToolPane.aspx?DisplayMode=Edit

The attack includes a forged Referer header pointing to /layouts/15/signout.aspx, which tricks SharePoint into skipping authentication and form digest validation. This fundamental flaw in SharePoint’s trusted internal workflow validation allows attackers to gain unauthorized access without providing any credentials.

CVSS Score and Classification

CVE-2025-53770 has been assigned a CVSS score of 9.8 (Critical), reflecting its severe impact potential. The vulnerability has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, emphasizing the urgent need for remediation across all affected organizations.

Attack Chain Methodology

The ToolShell exploit operates through three distinct phases:

Phase 1: Authentication Bypass Attackers exploit a logic flaw in SharePoint’s Referer header validation by sending a POST request with a forged Referer header, causing the server to treat the request as legitimate and process it under an unauthenticated context.

Phase 2: Web Shell Deployment Once inside the system, attackers deploy malicious ASPX files to the SharePoint layouts directory. These files, typically named spinstall0.aspx, are designed to extract cryptographic secrets including ValidationKey, DecryptionKey, and signing algorithms used by ASP.NET to validate __VIEWSTATE payloads.

Phase 3: Remote Code Execution With stolen cryptographic keys, attackers craft signed, malicious __VIEWSTATE tokens using tools like ysoserial.net. These payloads embed system commands and are sent to SharePoint pages via GET requests, leading to full remote code execution under the application pool identity (NT AUTHORITY\IUSR).

Active Exploitation in the Wild

Threat Actor Attribution

Microsoft has observed multiple Chinese nation-state actors exploiting these vulnerabilities, including Linen Typhoon, Violet Typhoon, and Storm-2603. Each group brings distinct tactics and objectives to their exploitation campaigns:

Linen Typhoon: Operating since 2012, this group focuses on intellectual property theft, particularly targeting government, defense, and strategic planning organizations.

Violet Typhoon: Active since 2015, specializes in espionage against former government personnel, NGOs, think tanks, and media organizations across the United States, Europe, and East Asia.

Storm-2603: A China-based threat actor with medium confidence attribution, previously associated with Warlock and Lockbit ransomware deployments.

Attack Clusters and Methodologies

SentinelOne researchers identified three distinct attack clusters, each demonstrating unique tradecraft and objectives:

Cluster 1: “xxx.aspx” Campaign This group deployed a password-protected ASPX webshell with basic HTML interface functionality, including authentication, command execution, and file upload features. The activity appeared manual and exploratory, indicating human operator involvement.

Cluster 2: “spinstall0.aspx” Campaign Observed in two waves on July 18-19, 2025, this group focused on deploying reconnaissance tools designed to extract and expose sensitive cryptographic information from compromised hosts. Unlike traditional command shells, these tools specifically targeted MachineKey data for persistent access across load-balanced environments.

Cluster 3: “no shell” Campaign The most advanced group employed fileless execution techniques, relying on in-memory .NET module execution and avoiding traditional file-based artifacts entirely. This method greatly complicates detection and forensic recovery efforts.

Global Impact and Exploitation Timeline

The vulnerability has been confirmed for active exploitation not only in the United States but also internationally. The Canadian Centre for Cyber Security confirmed exploitation occurring in Canada, highlighting the global scope of the threat. Microsoft first disclosed the vulnerability on July 19-20, 2025, after detecting active exploitation attempts targeting high-value organizations.

Targeted Organizations and Impact

Initial exploitation attempts targeted high-value organizations in technology consulting, manufacturing, critical infrastructure, and professional services tied to sensitive architecture and engineering organizations. The careful selection of targets suggests strategic objectives rather than opportunistic attacks.

The vulnerability poses particular risks because:

• SharePoint servers typically contain sensitive organizational data
• Vulnerable servers can be weaponized for internal watering hole attacks
• The unauthenticated nature makes exploitation relatively straightforward
• Multiple attack vectors allow for persistence and lateral movement

Organizations seeking comprehensive insights into SharePoint security frameworks and understanding attack methodologies can reference our detailed analysis on SharePoint Online Attack Matrix: Mapping Breaches, OAuth Abuse & Exfiltration, which provides in-depth coverage of breach mapping techniques, OAuth abuse patterns, and data exfiltration methods specific to SharePoint environments.